CVE-2018-3963 Command injection in CUJO
Attackers can execute arbitrary system commands on CUJO Smart Firewalls by sending malicious DHCP requests with unsanitized hostnames.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-3963?
CVE-2018-3963 is a critical command injection vulnerability in CUJO, published on 21 Mar 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address, its corresponding hostname is inserted into the dhcpd.conf file without prior sanitization, allowing for arbitrary execution of system commands. To trigger this vulnerability, an attacker can send a DHCP request message and set up the corresponding static DHCP entry.
Weakness: CWE-77
Which versions are affected by CVE-2018-3963?
It affects 1 product.
Products include Getcujo Smart Firewall.
How do I fix CVE-2018-3963?
No fix has been published for CVE-2018-3963 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2018-3963 being exploited?
There is no known exploitation of CVE-2018-3963 in the wild and no public exploit code.
Other vulnerabilities in CUJO
Sources
Also known as GHSA-665f-qp36-gp6g.